NullLogic Null HTTPd Error Page Cross-Site Scripting Vulnerability

Bugtraq ID:	5603
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 02 2002 12:00AM
Updated:	Sep 02 2002 12:00AM
Credit:	Reported by Matthew Murphy <[email protected]>.
Vulnerable:	NullLogic Null HTTPd 0.5
Not Vulnerable:

NullLogic Null HTTPd Error Page Cross-Site Scripting Vulnerability

NullLogic Null HTTPd is a small multithreaded webserver for Linux and Windows.

It is possible for attackers to construct a URL that will cause scripting code to be embedded in error pages. As a result, when an innocent user follows such a link, the script code will execute within the context of the hosted site.

NullLogic Null HTTPd Error Page Cross-Site Scripting Vulnerability

A sample exploit URL has been supplied by Matthew Murphy <[email protected]>:

http://localhost/a?x=<SCRIPT>alert(document.URL)</SCRIPT>

NullLogic Null HTTPd Error Page Cross-Site Scripting Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

NullLogic Null HTTPd Error Page Cross-Site Scripting Vulnerability

References:

• Null HTTPd Project Page (NullLogic)